Kubernetes Pod Security Standards

1. Privileged Profile

   Unrestricted policy with known privilege escalations allowed.

2. Baseline Profile

   Minimally restrictive policy preventing known escalations.

3. Restricted Profile

   Hardened policy following pod hardening best practices.

4. Pod Security Admission

   Enforce, audit and warn modes through namespace labels.

5. Enforce Standards with Namespace Labels

   Applying Pod Security Standards per namespace.

6. Enforce Standards Cluster-wide

   Configuring the admission controller defaults and exemptions.

7. Security Context

   runAsNonRoot, capabilities, readOnlyRootFilesystem and seccomp settings.

8. Migrate from PodSecurityPolicy

   Moving off removed PodSecurityPolicy.

9. Seccomp Tutorial

   Restricting syscalls using seccomp profiles.

10. AppArmor Tutorial

    Restricting container access with AppArmor.

11. User Namespaces

    Isolating container users from host users.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.